Missing NULL check on nvme_get_admin_request return potential kernel NULL-deref panic

Summary

nvme_getlog_ioctl calls nvme_get_admin_request() at line 49 but never checks return for NULL before dereferencing req at line 50 (req->cmd.head.nsid=-1). nvme_get_admin_request wraps nvme_get_request which CAN return NULL if admin submission queue full or no free request slots. KKASSERT guards at nvme.c:449/465 fire in INVARIANTS builds but KKASSERT compiled to no-op in production kernels without INVARIANTS (sys/systm.h:118) so NULL deref would reach hardware and panic. Practical exploitability very low: ioctl_lk serializes all NVMEIOCGETLOG calls only one admin request outstanding at a time admin queue has 64-256 entries. Defense-in-depth gap not exploitable vulnerability under normal conditions.